PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-23308 Linux CVE debrief

A logic error in the Linux kernel's pinctrl equilibrium driver causes spurious warning traces during GPIO initialization. The `eqbr_irq_mask_ack()` callback incorrectly invokes `eqbr_irq_mask()`, which internally calls `gpiochip_disable_irq()`. This triggers a WARN_ON trace for every GPIO at load time because the interrupt is being disabled in a context where it should not be. The issue affects Linux kernel versions 6.4 through 6.6.129, 6.7 through 6.12.76, 6.13 through 6.18.16, 6.19 through 6.19.6, and 7.0-rc1/rc2. The fix implements the mask-ack logic directly without calling the separate mask function, avoiding the improper interrupt disable. This is a local denial-of-service condition that generates log noise and potential boot delays, but does not enable privilege escalation or information disclosure.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-25
Original CVE updated
2026-05-28
Advisory published
2026-03-25
Advisory updated
2026-05-28

Who should care

Linux system administrators running kernels with the equilibrium pinctrl driver enabled; embedded device manufacturers using affected kernel branches; security teams monitoring for kernel warning anomalies that may mask more serious issues

Technical summary

The equilibrium pinctrl driver for the Linux kernel contains a logic flaw where `eqbr_irq_mask_ack()` calls `eqbr_irq_mask()`, which in turn calls `gpiochip_disable_irq()`. This generates a warning trace at boot for every GPIO because the disable operation is inappropriate in the mask-ack context. The vulnerability is local-only with no security boundary crossing, but creates denial-of-service conditions through log flooding and potential boot delays. The fix refactors `eqbr_irq_mask_ack()` to implement the mask and ack operations directly without invoking the helper functions, matching the pattern used in the similar starfive-jh7100 pinctrl driver.

Defensive priority

medium

Recommended defensive actions

  • Apply the appropriate stable kernel patch for your version branch: 6.6.130+, 6.12.77+, 6.18.17+, 6.19.7+, or 7.0-rc3+
  • Monitor kernel logs for 'gpiochip_disable_irq' warnings on affected systems as an indicator of unpatched status
  • If running custom kernels with the equilibrium pinctrl driver, cherry-pick the fix from the stable kernel git repository
  • Consider backporting the patch to long-term support kernels if vendor patches are not yet available
  • No runtime workaround exists; patching is required to eliminate the warning traces

Evidence notes

The vulnerability description and patch references confirm the issue is a warning trace generated by improper `gpiochip_disable_irq()` calls in `eqbr_irq_mask()` when invoked from `eqbr_irq_mask_ack()`. The fix removes the helper function calls and implements the logic directly. CVSS 5.5 (MEDIUM) reflects local attack vector with availability impact.

Official resources

2026-03-25